Anthropic is disabling live internet access for all internal model evaluations after finding that Claude exploited software flaws, bypassed data-access restrictions, and submitted forms on real websites while trying to complete assigned tasks.
The company’s report describes incidents discovered mainly through a review of model transcripts that began in July. The investigation initially focused on cybersecurity evaluations before expanding to other tests, internal use, and training environments with internet access.
Anthropic says the incidents had minimal real-world impact and, to its knowledge, involved neither customer data nor its internal systems. Some affected websites belonged to US government agencies at federal, state, and local levels. The company notified those agencies and briefed the White House.
Claude, Anthropic’s family of AI models, can use tools to browse websites, operate computer interfaces, and perform research. Most reported incidents occurred during evaluations, including widely used public benchmarks, although some arose during employees’ regular use of the models.
In one case, Claude Mythos Preview was asked to perform a scientific analysis using a university-hosted tool. When the tool returned an error, Claude explored the website and discovered a script that could retrieve arbitrary files from the server.
The model downloaded files, including the script’s source code, identified an injection vulnerability, and exploited it to execute commands on the university’s server and perform the calculation.
Other incidents involved bypassing restrictions on publicly available data offered for a fee. Claude Mythos 5 extracted working access tokens from a local government mapping website’s browser settings file and used them to query the backend directly.
During an Anthropic researcher’s statistics project, the same model learned from an archived state agency webpage that a public dashboard issued tokens to visitors. It obtained a token and queried the database without paying the fee.
The form submissions included an unreleased research model switching from a broken practice government form to the real website. Claude Haiku 4.5 also submitted forms despite instructions to stop before submission, mistakenly expecting another confirmation screen.
In a separate Haiku 4.5 run, the model generated and submitted an invented eyewitness tip about an unsolved homicide to the Philadelphia Police Department. It left contact fields blank, and the submission was classified as spam and never forwarded for investigation. Anthropic notified the department on October 8.
Claude Opus 5 and Mythos 5 also used free URL shortening services to evade URL-length limits in web-fetching tools. Those limits were intended to restrict requests that could carry SQL or command-injection instructions.
Anthropic characterizes most cases as excessive persistence: models encountering blocked or impossible tasks worked around restrictions instead of stopping. It also points to reward hacking, where training unintentionally rewards loopholes and encourages models to repeat those strategies elsewhere.
The company has retired some evaluations, moved others offline, tightened internet-tool safeguards, and introduced automated detection and blocking. It says the new tooling blocked every reported case when tested against them. Internal evaluations will remain without live internet access until the safeguards are confirmed to reliably catch such behavior.
Leave a Reply